Medical devices with proximity detection

ABSTRACT

A wireless medical device is disclosed. The wireless medical device comprises a processor, a memory, a sensor for detecting a physiological signal, a radio and a proximity detector to measure a distance of the wireless medical device relative to a second wireless medical device. The proximity detector includes a ranging functionality. A wireless communication channel is created when a distance between the wireless medical device and the second wireless medical device is within a first predetermined threshold. The distance is greater than zero.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of, and claims the priority andbenefit to, U.S. patent application Ser. No. 13/225,989, filed Sep. 6,2011, and entitled “Medical Devices with Proximity Detection” which is acontinuation-in-part application of, and claims the priority and benefitto, U.S. patent application Ser. No. 12/827,817, entitled “Body AreaNetwork Body Improvements for Clinical Workflows,” filed Jun. 30, 2010.All of the aforementioned patent applications and patents areincorporated herein by reference in their entirety.

BACKGROUND

Personal area networks in a medical setting permit sensor data from apatient to be efficiently transmitted to a display device. Many suchnetworks use Bluetooth technology both in sensors attached to thepatient and in the display device. Each Bluetooth sensor is typicallypaired to the display device to enable the transmission of sensor datato the display device.

In order for a Bluetooth sensor to be paired to a display device, powermust be applied to both the Bluetooth sensor, including the sensorradio, and the display device including, the display device radio. Eachradio must be in a connectable mode. Further, if the radios in thesensor and display device are not aware of each other, at least oneradio must also be in a discoverable state. Typically, wireless sensorsoperate on battery power. It is desirable that a mechanism for applyingpower to a wireless sensor be easy to use, minimize drainage of thebattery, connect to the desired display device and ensure that thepatient be correctly identified.

In a medical setting, it is important that sensor devices are correctlyidentified to ensure that the sensor devices are placed on the correctpatient. If the sensor devices are wired, the patient identification isusually not an issue, since the wire is run from the sensor directly tothe monitoring device. However, wireless sensor devices typically do notprovide any patient context, e.g., room number, patient ID, patienthistory, when attached to a patient, so identification of the correctwireless sensor devices with the correct monitoring devices can be anissue.

SUMMARY

Aspects of the disclosure are directed to a wireless medical device. Thewireless medical device comprises a processor, a memory, a sensor fordetecting a physiological signal, a radio and a proximity detector tomeasure a distance of the wireless medical device relative to a secondwireless medical device. The proximity detector includes a rangingfunctionality. A wireless communication channel is created when adistance between the wireless medical device and the second wirelessmedical device is within a first predetermined threshold. The distanceis greater than zero.

In another aspect, a method is disclosed for authenticating a connectionbetween two wireless medical devices. A first wireless medical device ismoved to the proximity of a second wireless medical device. A firstproximity detector on the first wireless medical device is used todetermine a distance between the first wireless medical device and thesecond wireless medical device. Authentication of a connection betweenthe first wireless medical device and the second wireless medical deviceis allowed when a distance between the first wireless medical device andthe second wireless medical device is within a first predeterminedthreshold. The distance is greater than zero.

In another aspect, a system is disclosed for transmitting physiologicaldata from a first wireless medical device. The system comprises thefirst wireless medical device and a patient monitor device. The firstwireless medical device comprises a first processor, a first memory thatstores a patient context and a first radio. The patient context providesan identifier for the patient. The first radio comprises a firstultra-wideband (UWB) transceiver that determines a first distancebetween the first wireless medical device and the patient monitordevice. The first radio uses the first distance as part of anauthentication process. The patient monitor device comprises a secondprocessor, a second memory that stores the patient context and a secondradio. The second radio comprises a second UWB transceiver. The firstwireless medical device joins a personal area network with the patientmonitor device when the first distance between the first wirelessmedical device and the patient monitor device is within a firstpredetermined threshold. The first distance is greater than zero. Thefirst wireless medical device obtains the patient context from thepatient monitor device. The patient context is obtained from the patientmonitor device when the first distance between the first wirelessmedical device and the patient monitor device is within the firstpredetermined threshold for at least a first predetermined interval oftime. The first wireless medical device transfers physiological data tothe patient monitor. The physiological data is transferred along withthe patient context. The patient context is removed from the firstwireless medical device when the first wireless medical device is partof a spot workflow and when a second distance between the first wirelessmedical device and the patient monitor device is greater than a secondpredetermined threshold for at least a second predetermined interval oftime.

The details of one or more techniques are set forth in the accompanyingdrawings and the description below. Other features, objects, andadvantages of these techniques will be apparent from the description,drawings, and claims.

DESCRIPTION OF THE DRAWINGS

FIG. 1 shows an example personal area network for a medical application.

FIG. 2 shows example modules of a physiological sensor and of thepatient monitor of FIG. 1.

FIG. 3 shows an example patient monitor that includes a proximitydetector.

FIG. 4 shows example components of the proximity detector of FIG. 3.

FIGS. 5 and 6 show a flowchart for a method of establishing a connectionbetween a sensor device and a gateway device in the personal areanetwork of FIG. 2.

FIG. 7 shows a flowchart for a method of transferring patient context toa sensor device in the personal area network of FIG. 2.

FIGS. 8 and 9 show a flowchart for a method of using ultra-widebandranging to establish a connection between a sensor device and a gatewaydevice in the personal area network of FIG. 2.

DETAILED DESCRIPTION

The present disclosure is directed to example systems and methods forpairing physiological sensor devices for a patient in a personal areanetwork. Pairing is a term defined in the Bluetooth Specification and itis used analogously herein, applying the pairing concept to any radio.In the systems and methods, a proximity detector is used to enabledevices to execute functions such as turning on power at a sensordevice, turning on power to a radio in the sensor device, and enablingthe radio device to making a radio connection between devices.Low-function proximity detectors may only detect proximity. Mediumfunction proximity detectors may detect proximity and also transmitout-of-band data, and may be used for authentication. High functionproximity detectors may also include ranging functions. The proximitydetector turns the power on at the sensor device when the sensor deviceis in close proximity to a gateway device. The gateway device istypically a monitoring and display device that also provides access to alocal or wide area network for transmitting sensor data to a servercomputer. The gateway device also includes a proximity detector.Typically, the gateway device includes a source of AC power so that thegateway device is generally powered on. However, in other examples, thegateway device may be battery operated and may not be powered on untilthe gateway device comes into proximity with a sensor device.

In example embodiments, the proximity detector on the sensor deviceprovides a magnetic mechanism to activate power at the sensor device.Each proximity detector includes both a magnet and a magnetic detector.When the proximity detector on the sensor device is in close proximitywith the proximity detector on the gateway device, the magnetic detectoron the gateway device detects the magnet on the sensor device and themagnetic detector on the sensor device detects the magnet on the gatewaydevice. Such a device has an advantage of very low power operation.

The detection of the magnet by the sensor device activates power on thesensor device and the detection of the magnet on the gateway deviceprovides an indication to the gateway device that power is activated onthe sensor device. In examples where the gateway device does not includeAC power or in cases where the gateway device does include AC power butis powered off, the detection of the magnet on the gateway deviceactivates power on the gateway device. Once power is activated on boththe sensor device and the gateway device, a Bluetooth pairing sequenceis initiated and the sensor device is paired to the gateway device.

If either the sensor device or the gateway device is already powered,then the proximity detection may power the radio, enable the radio andput the radio in a connectable state. If the radio in either the sensordevice or the gateway device is already powered, then the proximitydetection may put the radio in a connectable state.

Other proximity detectors may be used. If each device has a coil,magnetic coupling allows the coil in one device to detect if the coil inthe other device has a current. One could pulse current in the firstcoil and detect the current pulse in the second coil. Detection of thecurrent pulse in the coil of the first device by the coil of the seconddevice would indicate proximity. A related solution with a magnet and acoil in the first device and a magnetic detector and a coil on thesecond device could have the second device detect proximity of the firstdevice through actuation of the magnetic switch. The proximity detectioncauses the second device to enable its radio and also to pulse a currentthrough its coil. This current pulse is detected in the first device,causing it to enable its radio. Alternately, placing a load on thereceiving coil in the second device allows the transmitting coil todetect proximity of the receiving coil as reflected impedance of thereceiving coil's load affects the current and voltage in thetransmitting coil. Modulating the load modulates the current and voltageof the transmitting coil, allowing data to be transmitted from thesecond device to the first device. Proximity detection may beaccomplished through time stamps of related signals, such asacceleration when two devices are tapped together. A time stamp on thesignals can be used as a filter to ensure that the two devices weretapped at close to the same time. Alternately, a device may require aspecific sequence such as three taps before enabling the radio. Opticalsignals (IR, UV, or Visible) from one device may be received by thesecond and these could be both detected by the second device and bereflected back to the first device. By encoding the optical signal, onemay confidently assume the signal is authentic. A resistive detectioncould be used to detect if one device touches another as could one-wireserial where making electrical contact causes one device to transmitdata to the other, where the data may include a Media Access Control(MAC) address and other out of band communication such as a link key orPIN. Capacitive touch switches may be placed on a printed circuit boardor embedded in the plastic cases creating a hidden switch that isactivated when a hand is brought nearby. Ultrasonic transceivers,Ultra-Wideband (UWB) and RFID may be used for both proximity detectionand communication of out of band data. For example, UWB can be used todetermine if the range between two radios is less than 25 cm and onlythen allow the radios to connect. By only allowing the connectionbetween devices at close range, connections by devices external to thefacility can be prevented.

The term “out-of-band” refers to communications which occur outside of aprimary communication method or channel. In the UWB example, ifauthentication is a function of range and ranging is a secondary aspectof the UWB transceiver (the primary aspect being transmission of data),then the ranging used for authentication is an example of out-of-bandcommunication. Using received signal strength to infer relativedistances between devices would be considered an out-of-bandcommunication of distance. Out-of-band may also refer to using a secondchannel supported by a transceiver. For example, standard data may betransmitted on a first channel and high priority data may be transmittedon a second channel. As a second example, data may be transmitted on afirst channel and descriptors such as patient ID or annotations for thedata may be transmitted on a second channel. As a third example,BlueTooth might use 802.11 for authentication, there, 802.11 is theout-of-band communication channel. The term “authentication” refers to aprocess by which a first device is able to confirm the identity of asecond device and/or to confirm that the second device should betrusted. Authentication may be unidirectional or bidirectional.

The systems and methods of the present disclosure may also usecontextual data to determine when to change the radio state toconnectable or connectable and discoverable. For example, a sensor mayassume that it is in range of a gateway whenever the sensor is powered,whenever a new measurement is requested or when other contextual eventsoccur and automatically put its radio in a discoverable and connectablestate. Other contextual events include one or more of: losing connectionto a previous gateway, detecting a new gateway, detecting a decrease inreceived power from the current gateway, detecting an increase inreceived power from a new gateway, detecting a change in range to agateway, and receiving new patient information. Specific contextualevents to be considered depend on the clinical workflow, as discussedlater herein.

A personal area network is a computer network used for communicationbetween computer devices close to an individual person. A personal areanetwork may also be referred to as a body area network when the personalarea network is a collection of physiological sensors and monitors. Inthis disclosure, pairing refers to Bluetooth pairing and also toequivalent transmission of credentials and information, such as anaddress, required to establish a radio connection. These credentials mayinclude authentication credentials, such as public keys and nonces thatmay be used to authenticate devices for secure, authenticated datatransfer.

In a medical setting, a personal area network may include physiologicalsensor devices attached to a patient that are used to monitor healthparameters of the patient. Some examples of physiological sensor devicesused in a medical setting are blood pressure monitoring devices,thermometers, ECG sensors, EEG sensors, cardiac output sensors, ETCO₂sensors, oxygen saturation sensors (SPO₂), glucometers, weight scales,and blood pressure sensors. Other types of sensor devices can be used.The sensor devices typically transmit sensor data over a network to apatient monitoring device, such as a wall-mounted display unit or acentral station, such as the ACUITY® Central Monitoring System fromWelch Allyn, Inc. of Skaneateles Falls, N. Y. A personal area networkmay also include a smart phone such as an iPhone manufactured by AppleComputer, Inc. of Cuppertino, Calif. or a Personal Digital Assistant(PDA), perhaps used by a clinician to interact with the patients'personal area networks such as the Clinician Notifier product from WelchAllyn, Inc. of Skaneateles Falls, N.Y. The PDA could join a patientnetwork either using a menu-based system as is common for Bluetoothconnections today or it could have a proximity detector that causes thePDA to join the personal area network.

One type of radio device used in a wireless personal area network is aBluetooth radio. Bluetooth is a wireless technology that can be used inpersonal area networks to transmit and receive data over short distances(generally less than 30 feet, although data can be transmitted up 100meters depending on device class). Bluetooth uses a layered protocolarchitecture consisting of four core layers and associated protocols.The physical layer is the lowest layer in each Bluetooth device and isinstantiated as a radio frequency (“RF”) layer that includes atransceiver with transmit and receive capability. Bluetooth uses themicrowave radio spectrum in the 2.402 GHz to 2.4835 GHz range.

Bluetooth devices are peer devices, each including a Bluetooth radio andthe four core protocol layers. However, when two or more Bluetoothdevices are connected in a personal area network, one device can becomea master device and the remaining devices then become slave devices. Amaster Bluetooth device can communicate with up to seven slave devices.However, a slave can switch roles and become a master at any given time.A Bluetooth device may be a slave in one personal area network and amaster in a second personal area network. Later version of the Bluetoothspecification, such as Bluetooth LE, provide for a larger set of peerdevices.

Because Bluetooth is a wireless technology, the integrity and privacy ofthe transmitted data are a concern. To improve the integrity and privacyof data transmission, Bluetooth permits two devices to be paired witheach other where the devices transmit on an encrypted link so that theycan securely communicate with each other. Once two devices are paired,they can connect and communicate with each other without additional userintervention. The pairing process is typically initiated the first timea device receives a connection request from a device to which it is notalready paired. During the discovery process Bluetooth addresses of eachdevice are shared and during the pairing process, a shared secret key,known as a link key, is generated by the two devices. This link key isused to generate an encryption key, which is used to encrypt data forthe current session. If the link key is stored along with the Bluetoothaddress of the peer device, then the devices are bonded so that thepairing information can be used in the future, even if the device(s) hasbeen power cycled or if the devices have been out of range of eachother. If either device deletes the link key, pairing must occur againbefore communication can occur. At the start of each communicationsession, the link key is used in a process to cryptographicallyauthenticate the identity of the device, and be sure that it is the samedevice with which it previously paired.

In a wireless personal area network, sensor data is transmitted using awireless data exchange protocol, such as Bluetooth, to a central point,called a hub. Often, this central point has a connection to a largernetwork, such as an 802.3 or 802.11 LAN. In this disclosure, a hub witha connection to a different type of network is called a bridge or agateway.

In a wireless personal area network for monitoring sensor data, eachsensor device may be joined to the network. In Bluetooth, joining anetwork when none of the network information is known requires discoveryto learn the Bluetooth address of the other device, connection toinitiate communication, and pairing to generate a shared secret key forauthentication and encryption. While this disclosure uses Bluetooth asan example personal area network, any network, including 802.15.4,Bluetooth LE, ZigBee, UWB, a low-power 802.11 network, Wi-Fi™ Direct, ora proprietary network could be used. Other physical media such as IR asdisclosed in the IEEE 802.11-1999 standard and ultrasonic may be used inlieu of RF. Of these, some technologies allow for ranging and rangingallows proximity detection. These include at least UWB, IR, andUltrasound.

A hub to which multiple sensors are paired that includes a display toshow the physiological state of the patient is a patient monitoringdevice. This type of hub typically has a local area network uplink,making the patient monitoring device a bridge. Any RF enabled devicewith a processor and display, including a PDA, cellular phone, PC, orlaptop can operate as a hub and also as a patient monitor. Theappropriate pairing of a sensor device with a patient monitoring deviceensures that the sensor data is properly transmitted to the correctmonitoring device. This is particularly important in a medical settingthat may include a plurality of patients, sensors, monitoring devicesand personal area networks to ensure that a particular patient'sphysiological data is tagged with the correct patient identifier. Thepatient identifier may be encrypted independent of any encryption thatoccurs automatically on the communication link to further ensureprotection of electronic personal health information.

The procedure for pairing a sensor device to a monitoring devicetypically requires a user to manually enter data to authenticate thatthe proper devices are connecting in order to complete the pairing. Forexample, using Bluetooth 2.0, the two devices that pair require that thesame PIN is presented to both devices. For some limited functionalitydevices, such as headsets, the PIN for the headset may be hard codedinto the headset and the user enters the PIN into the device to bepaired, e.g., a cellular telephone. Since no data are transacted priorto PIN entry and the PIN is not transmitted, this process verifies thatthe user intends the two devices to establish a connection. Thissolution works reasonably well if the device is only to be paired once.The PIN solution also has security and usability issues, particularly asimplemented. For example, the PIN for most headsets is an easy toremember number such as 0000 or 9999, so an intruder can guess the PINand masquerade as the intended device. In addition, a brute force attackrequires only 10,000 different sequences (Although Bluetooth 2.0 uses a16-byte PIN, this is usually generated by augmenting a 4-digit PIN withpart of the Bluetooth address of the device, which is known). If the usecase requires pairings to be made, removed, and re-built as occurs inclinical applications, the time to enter the PIN and navigate menus maybe cumbersome. The systems and methods described in the presentdisclosure permit sensor devices to be attached to a patient and pairedto a monitoring device in an efficient and automated manner, therebyminimizing the need for a user to manually enter information.

An improved pairing mechanism introduced in Bluetooth Version 2.1+EDR isSecure Simple Pairing (SSP). SSP has four modes of operation: NumericComparison, Passkey Entry, Out-Of-Band (OOB), and Just Works. With thefirst two modes, some degree of user intervention is required to eitherenter or compare numeric values that are computed as a function of thelink key. In the third mode, an auxiliary set of transceivers must existto transmit the Bluetooth pairing information. In the fourth mode, thedevices assume that a user authentication step occurred and opens thedevice to a security risk, such as a man-in-the-middle (MITM) attack.This risk can be mitigated by only placing the devices in a pairing modewhen proximity is detected and also through application-level filteringof the devices. For example, if the radios are neither connectable nordiscoverable, except for a few seconds while the pairing information isexchanged, it is extremely unlikely an eavesdropper could detect thePersonal Area Network (PAN) and generate a MITM attack before thepairing completes. If an incorrect device pairs, application levelsoftware can cause the radio to delete pairing information and destroythe RF connection. Such deletion and destruction can occur before anydata are accepted across the RF link. Application level software candetermine correct device pairings through several methods includingcomparing the Bluetooth address to a known list of acceptable addresses,through an application level challenge-response or other authenticationsolution.

FIG. 1 shows example physiological sensors that can be used on a patient102 in a personal area network for a medical application. The fourphysiological sensors include an example thermometer 104, ECG sensor106, blood pressure sensor 108 and SPO₂ sensor 110. The SPO₂ sensor isalso known as an oxygen saturation sensor. The physiological sensors104, 106, 108, and 110 can be paired to patient monitor 208 andcommunicate with a medical application over a personal area network, asdescribed below.

FIG. 2 shows an example personal area network 200 for a medicalapplication. The example personal area network 200 includes the exampleSPO₂ sensor 110 and an example patient monitor 208. The example personalarea network 200 may also include one or more of the examplephysiological sensors 104, 106 and 108 (shown in FIG. 1). Each of theexample physiological sensors 104, 106, 108, 110 has PAN capability. Theexample SPO₂ sensor 110, as well as the example sensors 104, 106 and108, also includes a proximity detector 202, sensor electronics 204 anda PAN radio 206. The proximity detector 202 may be disposed within theradio 206. For a Bluetooth radio, an approximate proximity detection maybe made using signal strength. For an UWB radio, absolute ranging may bepossible, allowing not just proximity detection, but also the precisedistance between two UWB radios.

The example patient monitor 208 includes a proximity detector 210 andmay include one or more embedded sensors 212 that have a physicalattachment to patient monitor 208. The patient monitor also includes adisplay 214 that indicates the state of various sensors and networkconnections. In addition, the patient monitor 208 includes a PAN radio216 and a LAN/WAN connection 218, providing a gateway 217. The LAN/WANconnection 218 permits data to be transmitted between the examplepersonal area network 200 and one or more server computers 220 that areaccessible via the LAN/WAN connection. Other network connectionsincluding mesh, UWB, MAN and the like may allow connection to the one ormore server computers 220, patients sensors 210, or other patientmonitors 201

Typically, the example physiological sensors 104, 106, 108, 110 are notpowered on until they are activated and placed on the patient. Theexample patient monitor 208 may be continually powered on. For example,the patient monitor 208 may be wall-mounted unit or may be permanentlymounted to a stand or other apparatus in hospital room. When the patientmonitor 208 is permanently mounted, the patient monitor 208 typically isconnected to AC power and is typically continually powered on.Alternatively, the patient monitor 208 may be a portable unit that isoperated via battery power. When the patient monitor 208 is a portableunit, the patient monitor is typically powered on manually via apower-on button. However, in examples, a portable patient monitor mayalso be power on automatically via the proximity detector 210.

Considering a Bluetooth PAN and other radios that have similarconnectivity solutions: in order for Bluetooth pairing to occur,Bluetooth devices must be both discoverable and connectable. By using aproximity detector in a Bluetooth device, for example physiologicalsensor 110, the Bluetooth device may be kept in a low power state tosave power until the Bluetooth device is moved into close proximity witha second Bluetooth device, for example patient monitor 208.

In some examples described herein, the physiological sensor 110 is off.In other examples, the physiological sensor 110 can be in a low powerstate including for example any of the following and combinationsthereof: the physiological sensor 110 being completely off, themicroprocessor of physiological sensor 110 operating in a low powermode, the radio in physiological sensor 110 being in a low power mode,the radio in physiological sensor 110 being on, but not in a connectablestate, or the radio in physiological sensor 110 being off. Regardless ofthe state of the physiological sensor 110 and its radio, detection ofanother proximal device causes the physiological sensor 110 and itsradio to move to a state where the radio can connect to another device.

Starting from a state where physiological sensor 110 and patient monitor208 have never had a PAN connection, when the physiological sensor 110is moved proximally to the patient monitor 208, power is turned on atthe physiological sensor 110, power is turned on at the patient monitor208 if power is not already turned on at the patient monitor 208, theradios on both the physiological sensor 110 and the patient monitor 208are placed in connectable mode and at least one radio is placed indiscoverable mode, and pairing occurs between the physiological sensor110 and the patient monitor 208. The pairing establishes a wirelessconnection between the physiological sensor 110 and the patient monitor208. Note that if sensor 110 and patient monitor 208 have previouslypaired and bonded, the radios do not need to discover each other.Similarly, if the sensor 110 and patient monitor 208 have beenprovisioned with the pairing information, perhaps at manufacturing, theradios do not need to discover each other. Once paired to the patientmonitor 208, the physiological sensor 110 is placed on the patient 102and physiological data is sent from the physiological sensor 110 to thepatient monitor 208 via the wireless connection. For a body-worn patientmonitor 208, pairing may occur after the sensor is placed on the patient102 and pairing may occur after the patient monitor 208 is placed on thepatient 102.

Providing an auxiliary, low power discovery permits the medical deviceto be selective in the devices with which it might connect. For example,upon detection of an auxiliary discovery signal, the radio may changestate to “discoverable” or “discoverable and connectable” for a limitedtime so that only the opportunity to connect to the wrong device isdecreased compared to a device that is always in the “discoverable” or“discoverable and connectable” state. If both sides of the connectionhave this feature, then the opportunity to connect to the wrong deviceis further diminished. When one device is AC powered, the radio may bekept in connectable and discoverable mode all the time and rely on thephysiological sensor 110 to correctly initiate pairing. However, if thedevice is always in a connectable and discoverable state, theopportunity is open for either the wrong device or a malevolent deviceto connect. Alternately, the AC powered device may exit discoverablemode, but stay in connectable mode. This allows another sensor, perhapsone that has lost contact with its primary gateway, to sendphysiological data via an alternate gateway. Even if this other sensordoes not have a patient ID, a unique identifier such as the sensorserial number can be associated to the patient. With this uniqueidentifier, sensor data transmitted via an alternate gateway can beassociated with the correct patient ID at the server computer 220.Another case for keeping radios in connectable mode allowsre-connections to occur. Once a physiological sensor is communicatingwith a patient monitor, each will likely keep its radio in connectablemode, but not discoverable mode. This allows the two devices tore-connect if the RF link is broken, but does not allow any otherdevices to discover the PAN. To keep the network more secure but stillallow devices to reconnect, the devices may also exit both discoverableand connectable states after connecting to sensors and upon loss of RFconnection move to the connectable state.

As devices connect to different gateways, the status of those devices,including location, need for periodic maintenance, battery status,software revision and the like may be annotated to a server for use bythe biomedical engineers and clinicians. After Bluetooth pairing iscompleted, status and configuration information are transferred betweensensor device and gateway device, for example between physiologicalsensor 110 and patient monitor 208, to verify that both the sensordevice and the gateway device are operational and compatible with eachother. For example, application software of patient monitor 208 mayquery physiological sensor 110 to verify that physiological sensor 110has passed a diagnostics self-test, to verify the strength of a batteryon physiological sensor 110, to determine if any component ofphysiological sensor 110 is in need of repair or due for periodicmaintenance, or to determine the status of the RF connection. Thisstatus information may be transmitted along with other parameters fromthe monitor such as its own RF connection strength to the IT network,battery status, and location. These data may be used to trendperformance, debug connection issues, or to determine if maintenance isrequired. In addition to the status information, the sensor providesmodel and version information. The model and version of the sensordevice are compared with the model and version of the gateway device todetermine whether the sensor device and gateway device are compatible.

When the sensor device and the gateway device are paired, the sensordevice and the gateway device are said to have a logical connection witheach other that is analogous to the connection that occurs when a cableis plugged into the monitor. This logical connection may occur at an RFlevel or at an application level. For example, the logical connectionmay occur at the RF level after the devices are paired or the logicalconnection may occur at the application level when the compatibilitycheck between devices is completed. In the cable analogy, plugging thecable into the device is analogous to the RF connection and the devicerecognizing the cable and the sensors at the end of that cable areanalogous to a connection at the application level.

After status and compatibility are checked and verified between sensorand gateway devices, a clinician may be required to verify the sensordevice for a specific patient requiring the clinician to confirm thesensor device for a specific patient provides an additional level ofsecurity to ensure that the sensor device is placed on the correctperson. In addition, the clinician must confirm the sensor for aspecific patient within a short time period after the sensor device andthe gateway device are placed in connectable and discoverable modes.Through confirming the device the clinician indicates to the system thatthe data from the new sensor belongs to the same patient as is indicatedon the patient monitor. If the clinician does not confirm the sensor fora specific patient within the short time period, the wireless connectionbetween the sensor device and the gateway device is broken and thelogical connection between the sensor device and the gateway device isdestroyed. The reset of the logical connection might include removal ofthe pairing information. By allowing pairing for only a short timeperiod after the sensor device and the gateway device are placed inconnectable and discoverable modes, MITM attacks are minimized. The timeperiod must last long enough for both radios to enter the connectablestate and connect or to enter the connectable and discoverable state, bediscovered, and connect. A short time period may be range from a hundredmilliseconds to several seconds. Preferably, the radio exits theconnectable state or the connectable and discoverable state immediatelyupon initiation of a radio connection. Leaving the logical connection inplace could allow the sensor to maintain a connection to the incorrectmonitor. The system may be configured to allow the unconfirmedconnection to remain; but without indicating the patient ID. In thiscase, a pseudo-ID may be used to identify the data until such time as apatient ID is assigned to the sensor. For example, the data might besaved in a database keyed by the sensor serial number instead of thepatient ID. If the sensor is later correctly connected to the properpatient monitor, the data that has been thus far collected and stored isannotated with the patient ID associated with the proper patientmonitor. In a solution with proximity detection that supports ranging,the system may have a set of rules that determine when the clinician isrequired to confirm the sensor device for a specific patient. Forexample, if a ranging solution has 25-cm range resolution and onegateway is detected within a range of 1 meter and no other gateways aredetected within a range of 3 meters, it is likely that the sensor isintended to connect to the gateway within a 1-meter range. The rules maydictate cases where a clinical confirmation is required, for example iftwo gateways are within a 1-meter range. The rules may present to theclinician a list of gateways from which to select for connection, basedon range to the gateways. This latter case provides the clinician ashort list of likely gateways (and hence patients) from which to choose.

After the clinician confirms the sensor device for a specific patient,the clinician selects a connection mode for the connection between thesensor device and the gateway. The connection mode describes the extentto which alarms and equipment alerts are generated in the connection. Analarm refers to an error condition for a patient while an equipmentalert refers to an error condition for the medical equipment.Application software at the gateway device permits the clinician toassign one of three connection modes—loose pairing, tight pairing andlocked. Each connection mode is defined to match a specific workflow andprovides a class of alarm response. For example, loose pairing providesone class of alarm response, tight pairing provides a second class ofalarm response and locked provides a third class of alarm response.Other application-level connection modes and combinations thereof may beused to match different workflows.

Loose pairing is typically used for a spot monitoring workflow in whicha sensor device is periodically brought into a patient's room to check aphysiological parameter that is not being monitored by the patientmonitor in the patient's room. This is sometimes referred to as spotchecking. In a workflow that uses loose pairing, there are no equipmentalerts if the connection between the sensor device and the gatewaydevice is broken. There may also be no alarms as the workflow includes aclinician at the patient location.

Tight pairing is typically used for a workflow in which there iscontinuous monitoring of patient physiological data. In a tight pairingconnection, an equipment alert is generated whenever certain errorconditions occur. For example, an equipment alert is generated when thewireless connection between the sensor device and the gateway device isbroken. This is analogous to an equipment alert if an ECG cable isremoved from the monitor or the ECG electrode falls off the patient.Another error condition that causes an alarm to be generated is when thegateway device determines that one or more physiological parametersreceived from the sensor device is above or below a predeterminedthreshold. Other error conditions that cause an equipment alertcondition to be generated include: need for maintenance (includingscheduled periodic maintenance), sensor device loss of power,unacceptable RF performance such as high packet loss or poor signallevel, RF interference, inappropriately sized blood pressure cuffdetected, ECG lead failure, SPO₂ sensor with no signal detected, asensor that is not confirmed for a particular patient, and otherequipment alerts familiar to those skilled in the art.

When an error condition occurs in the tight pairing connection modewhere the connection from the patient to the device comes into question,in addition to an alarm being generated, the wireless connection betweenthe sensor device and the gateway device may be broken and pairinginformation for the connection may be deleted at the sensor device andat the gateway device. For example, if a physiological sensor falls ofthe patient, when the physiological sensor is re-attached, the clinicianmay be required again connect the Bluetooth radios. The deletion ofpairing information when the connection is broken prevents physiologicaldata from the sensor device from being associated with an erroneouspatient identification number. Alternately, the application levelsoftware may allow the Bluetooth connection to persist, but stopannotation of the data with the patient ID until the patient ID isconfirmed. A system may also stop the data flow from the sensor untilthe patient ID is confirmed. Patient ID may be confirmed through manymeans, including a clinician making a confirmation step, absolute rangeto a gateway, absolute range to other physiological sensors, orcorrelation of physiological signals. The system may present a menu forthe clinician to confirm the sensor for the patient. The system mayassume that if the range to the gateway is less than a pre-determinedthreshold, the system may confirm the sensor for the patient with noclinician action. The pre-determined threshold is configurable to meetthe needs of various workflows. The system may have a record of the dataand use an algorithm such as pattern recognition to verify the sensor isstill attached to the same patient or the system may correlate thephysiological signal from the unconfirmed sensor with physiological datafrom a confirmed sensor to determine if they are still on the samepatient. If the data correlates, the system may begin annotating datafrom the previously unconfirmed sensor.

Locked pairing is used when it is determined that a sensor device isonly to be connected to a specific gateway device, for example to thepatient monitor 208 or to a select set of gateway devices. A monitor ona roll stand with wireless sensors is an application where lockedpairing may be useful. When a sensor device is used with locked pairing,an equipment theft alert is generated when an attempt is made to connectthe sensor device to a gateway device that is not included in the selectset of gateway devices. The intent of a locked connection is to minimizethe potential for the sensor device from being moved, borrowed or stolenfrom the gateway device to which the sensor device is connected. Toallow the locked sensor device to be moved to a different gateway, asmay be the case when the original gateway is damaged or has a deadbattery, a reset capability is designed into the product. This may bethrough a hidden service screen, a reset button, through a specific setof key strokes or similar method that obscures the ability to remove thelocked pairing configuration.

The present disclosure is also directed to example systems and methodsfor using a ranging feature of the proximity detector to determinewhether to add the sensor device to a PAN. Once a sensor device isjoined to a PAN and a gateway in the PAN has patient context, the systemmay assume that all data from sensors in the PAN is to be associatedwith the same patient. This gateway is the patient's primary gateway.Data transmitted to the primary gateway will be recorded in thepatient's medical record. However, in some cases it may be that sensorslose connection to the primary gateway. The sensors may safely maintainthe patient context while continuously attached to the patient. Thiscontinuous attachment can be determined if the sensor is continuouslymaking a physiological measurement, through a skin contact sensor, orsimilar means. Sensors that lose connection to a primary gateway mayuplink data via an alternate gateway if the sensors have the patientcontext, e.g. patient identifier, (PID) and transmit it with the datavia the alternate gateway or if the alternate gateway has the patientcontext. For an alternate gateway to obtain the patient context, theprimary gateway may transmit the sensor's unique ID, e.g., MAC address,and the patient context, e.g., PID, to all other gateways in range.Then, the alternate gateway can associate the physiological datareceived from the sensor with the Patient ID: when a sensor joins analternate gateway, the alternate gateway associates the physiologicaldata with the sensor's unique ID and associates the sensor's unique IDto the patient ID. Another way to support roaming is for all sensors totransmit a unique ID with the patient data and have a system databasethat stores the mapping between unique ID and patient ID. When a sensorjoins a primary gateway, the primary gateway receives the sensor'sunique ID and sends the sensor's unique ID along with the patient ID tothe system database. When a sensor moves to an alternate gateway, thesystem may associate the patient ID to the received physiological databased on the sensor's unique ID. This pseudo-PID may be used if thesystem knows a unique serial numbered sensor is associated with patientID. In this case, the sensor can transmit its serial number and the datavia an alternate gateway and the system can lookup the PID based on theserial number. In addition, when the sensor device is added to the PAN,the systems and methods provide for transferring patient context,typically in the form of a patient identifier (patient ID), to thesensor device. Other examples of patient context are a room number,clinician, date of birth, gender, and patient history. Pseudo patient IDmay also be any unique number, e.g. a serial number or MAC address, whena database maps that unique number to a patient identifiable datum suchas patient ID. Other examples of patient context and of pseudo patientIDs are possible. In the case of using a pseudo patient ID, the pseudoID would be transmitted to the gateway after the sensor joins the PAN,allowing the system to associate patient context via the pseudo patientID. The systems and methods provide for transferring patient contextfrom the sensor device along with any physiological data that istransferred from the sensor device. Transferring patient context alongwith physiological data helps ensure that physiological data from thesensor device is correctly identified, particularly in the case wherethe patient's sensors are out of range of the patient's primary gateway(one that has the patient context) and upload the data via a differentgateway. In some workflows, for example taking patient vitals in atriage setting, there is no need to maintain patient context for a longduration nor across multiple gateway and in these cases, patient contextmay only exist in the primary gateway.

The ranging feature of the proximity detector makes uses of UWB todetermine the distance between the sensor device and other devices withcompatible UWB transceivers. For example, a sensor may determine thedistance between itself and a patient monitor on the PAN with an UWBtransceiver, for example patient monitor 208. The sensor may alsodetermine the distance between itself and at least one other sensor withan UWB transceiver. Based on the distance between the sensor device andthe at least one other sensor device or the distance between the sensordevice and patient monitor 208, a rules engine determines whether thesensor device may be added to the PAN. Typically, the ranging featureprovides for accurately determining distances as close as 10 cm andcontinues to operate as long as the two radios maintain a communicationlink. For a radio operating in a PAN, this range is typically on orderof 10 m, with approximately 10 cm resolution. For radios operating withhigher signal to noise rations, the maximum range increases and rangingresolution improves. The sensor device to be added to the PAN, forexample an SPO2 sensor, is typically brought into a hospital room by aclinician. The SPO2 sensor typically sends out ranging signals and thefrequency of ranging signals may be traded off against powerconsumption. Typically, a ranging response must be under 1 second or theuser detects a lag in the system response. As a result of exchangingranging signals, the SPO2 sensor determines the distance between theSPO2 sensor and the one other sensor device or the distance between theSPO2 sensor and patient monitor 208. When the distance between the SPO2sensor and the one other sensor device or the distance between the SPO2sensor and patient monitor 208 is within a predetermined threshold, adetermination is made to add the SPO2 sensor to the PAN. Thepredetermined threshold is stored on the SPO2 sensor and may beconfigurable. A typical threshold is 25 cm, and other thresholds arepossible. For example, if a hospital ward has a standard room layout,the threshold may be the distance from the door in the patient room tothe patient monitor 208 in that same room. When the SPO2 sensor ispowered on, the SPO2 sensor may immediately begin sending rangingsignals. The rate of sending ranging signals may change over time, forexample, high at turn on and high immediately after detecting anotherdevice is within a range of perhaps 5-meters, but low at other times tosave power.

When it is determined that the SPO2 sensor is to be added to the PAN,the SPO2 sensor is first identified and authenticated. With a rangingtechnology such as UWB, a range requirement may be implemented as partof authentication between sensor devices. The system may be configuredto transmit authentication information over the primary channel when therange is within a certain value. The system may be configured to requireno authentication except determination that the range is within acertain value. In this case, ranging would be considered authenticationusing an OOB channel. When the ranging occurs simultaneous to the datatransmission, a man-in-the-middle attack is mitigated as this sort ofattack would result in transmissions from a range that exceeds apredetermined distance. The system may also be configured to use an OOBchannel for transmitting authentication credentials such as MAC addressand link key. Authenticating the SPO2 sensor (and other sensor devices)when the SPO2 sensor distance is within the predetermined thresholdhelps minimize MITM attacks.

Out-of-band communication may use one or several mechanisms, forexample, infrared, ultrasonic, magnetic, Wi-Fi, etc. As an example ofout-of-band authentication using a magnetic means, the coil of theproximity detector in the SPO2 sensor may be used to transmit the MACaddress. The MAC address may be transmitted by pulsing current throughthe coil in the SPO2 sensor on and off thereby modulating the MACaddress onto the current. The modulated pulsed current from the SPO2sensor is detected and demodulated by a coil in the one other sensordevice or gateway device already on the PAN. Similarly, the two sidescan generate and then share (or compare) a link key across the OOB link.Various types of modulation can be used, including amplitude modulationand phase modulation. For example, amplitude modulation may beimplemented by varying the amount of current that is pulsed in the coil.A small amount of current produces small pulses and a large amount ofcurrent produces large pulses. Other methods of in-band and out-of-bandauthentication are possible.

Once the SPO2 sensor is authenticated, a determination is made as towhether the SPO2 sensor is to inherit the patient context of the PAN.The determination is needed to ensure that patient context istransmitted to the correct sensor device. It may be that oncerange-based authentication occurs, patient context is automaticallycommunicated to the sensor device. Range-based authentication may beeither uni-directional or bi-directional. In uni-directional,range-based authentication, only one device needs to determine whetherit is within a pre-determined range threshold. In bi-directional,range-based authentication, each device measures the distance to theother and each device determines whether it is within a pre-determinedrange threshold of the other device before authentication is complete.

When making a determination as to whether another device such as theSPO2 sensor is to inherit the patient context of the PAN, severalfactors may be considered. One factor is the distance between devices(for example the distance between the SPO2 sensor and the one othersensor device on the body of the patient, already part of the PAN). Asecond factor is a time interval that the distance between devices iswithin the predetermined threshold. The time interval is consideredbecause devices may come into close range for many reasons. For example,clinicians may have a sensor device in their pocket at the time that theclinician comes in close contact with the patient. The clinician maybriefly come in close enough contact with the patient that the sensordevice in the clinician's pocket may be within the predeterminedthreshold. However, in this case the sensor device in the clinician'spocket is not meant to join the PAN. However, if the clinician puts thesensor device on the patient, it is a better indication that the sensordevice from the clinician's pocket is to be part of the PAN. Byconsidering the time interval that one sensor device is in closeproximity to another sensor device, a more accurate determination can bemade as to whether the sensor device should join the PAN. An alternatesolution is to allow the sensor to join the PAN with the second factorof time interval set to 0. In this case, the sensor would join thenetwork, but when the clinician leaves the patient proximity with thesensor, the rules engine removes the patient information because itexceeded a predetermined range threshold without ever have made aphysiological measurement. A clinical use case may indicate that a smartphone, PDA, tablet or similar device the clinician carries is to jointhe PAN to learn the patient context, allowing an application on thesmart phone to automatically call up germane forms, documents, or datafor that patient. For example, when a smart phone learns the patient ID,the smart phone may automatically present a form for display and entryof vital signs measurements when the user of the smart phone has therole of recording vital sign measurements. Alternately, the applicationmight start an electronic health record (EHR) application, such asCare360™ or AdvancedMD™. When a sensor on the PAN makes a reading andtransmits it, the reading is communicated to the EHR application,typically via an application program interface (API). If the user of thesmart phone has the role of diagnosis (e.g., physician), then theapplication might call a different view of the EHR or form, for examplephysical exam notes, recent lab results, ECG or EEG waveforms, x-rays,or similar relevant data. Since the smart phone likely doesn't have theresolution to display an x-ray, the smart phone may work through thenetwork to discover a local display and cause the image to display onthat local display. These examples of using proximity/ranging along withthe clinical use case allow software to present appropriate informationto the caregiver.

A third example factor is whether the sensor device has made aphysiological measurement, particularly if the sensor device has made ameasurement within a range of a pre-determined threshold. For example,if the sensor device is an SPO2 sensor and one or more SPO2 readingshave been taken from the sensor device, it is a good indication that thesensor device should join the PAN for the patient. Other example factorsmay be considered.

In examples, the rules engine determines whether a sensor device ispermitted to join a PAN and whether patient context is to be transferredto the sensor device. The rules engine evaluates one or more of thefactors discussed in order to make this determination. In addition, therules engine may evaluate other factors. The authentication step used todetermine that patient context is to be transferred to the new device,typically includes use of an out-of-band channel, e.g., determiningrange. The patient context may also be transmitted over an OOB channel.Even if patient context is not transmitted to the sensor device, withthe sensor validated as a member of the PAN, the sensor can transmitdata to the patient monitor, where the data and patient ID areassociated. Data may be subsequently transmitted to the EHR/EMR.

Transferring patient context to the sensor device via an OOB channel issimilar to authentication via the OOB channel. The patient contextcomprises an identifier for the patient, typically a PatientIDentification number (PID). The OOB channel may be a magnetic channel,as discussed for authentication or it may be another type of OOBchannel, such as IR, ultrasound, wi-fi, using an NFC standard, UWB, etc.In examples, once the sensor device is authenticated and a determinationis made to transfer patient context to the sensor device, the patientcontext for the sensor device is obtained from the patient monitor 208.The patient monitor 208 typically stores patient context so that thepatient context can be displayed on a display screen of the patientmonitor 208. In cases where the patient context is not stored on thepatient monitor 208, the patient monitor 208 may obtain the patientcontext from the EMR/EHR system via gateway 218, from the ADT (admitdischarge transfer) system via gateway 218, or by clinician entry of theinformation. Once the patient monitor 208 obtains the patient context,the patient monitor 208 transfers the patient context to the sensordevice using either the OOB channel or authenticated primarycommunication channel. The patient context is then stored on the sensordevice. Transferring patient context by these means helps ensure thatthe personally identifiable information (PII) is securely transmitted,particularly in the case where a secure link on the primary channelcannot be created.

Some sensor devices, for example a thermometer, have limited memory andare not able to store patient context information. When a sensor deviceis unable to store patient context, a serial number for the sensordevice may be correlated with patient context. The serial number ineffect becomes a pseudo patient ID. In examples, the serial number maybe the global identifier sent to the patient monitor 208 during theauthentication process. When temperature data is subsequentlytransmitted from the thermometer to the patient monitor 208, the serialnumber is transmitted along with the temperature data. When the patientmonitor 208 receives the temperature data and serial number, the patientmonitor 208 looks up the patient context from the serial number andidentifies the patient for which the temperature data is transmitted.Once the patient context has been identified for the temperature data,the patient monitor 208 is able to send the temperature data and thepatient context to the EMR/EHR system.

The radio on the sensor device typically is programmed with a defaultconfiguration, including such parameters as the predetermined thresholdfor ranging. The default configuration may be updated in real-timewithout requiring a reset of the sensor device.

The sensor device may determine ranging information based solely oncomponents included with the radio. Ultra-wide band components areincluded in the sensor device. No add-on accessories or software areneeded as is the case in typical Wi-Fi location solutions. Bluetooth andWi-Fi solutions both lack the ability to perform precise ranging.

The time duration for which patient context is stored on the sensordevice is dependent upon a clinical workflow. Different workflows may beused for a patient in a medical setting. Some example clinical workflowsare continuous monitoring and spot monitoring. Within these workflows,sensors may have monogamous and polygamous connection profiles. Otherexample workflows may be used. With a continuous workflow, sensor datais obtained from the patient and transmitted to the patient monitor 208on an ongoing and continual basis. For a continuous workflow, patientcontext remains stored on the sensor device even when the primarygateway is not available. When the patient ambulates with the wirelesssensor devices, the wireless sensor devices can connect to any hub orgateway to upload data. Because the wireless sensor has the patientcontext, it can transmit the patient context with the data, allowing theend receiver to unambiguously match the data with the correct patientrecord. With a spot workflow, sensor data may be obtained from thepatient on a periodic basis, for example whenever a clinician enters aroom and takes vital signs for the patient. With a spot workflow, sensordevices may be periodically added on the body of a patient andperiodically removed from a patient. When a sensor device is permanentlyremoved from a patient, any stored patient context on the sensor devicealso needs to be removed from the sensor device. With a monogamousconnection profile the sensor is provisioned to connect to exactly oneother device. When the sensor turns on, the sensor attempts to connectto only that one device. This connection profile is useful when, forexample, a sensor is to stay in the same room and connect to the patientmonitor in that room. This profile is not agile, and once provisioned,it is understood that the patient context of the patient monitor and thepatient context of the sensor will be the same. When a new patient isbrought to the room, the patient context of the patient monitor isupdated to match the new patient. With a polygamous connection profile,the sensor is provisioned to connect to any member of a set of otherdevices. For example all thermometers on a hospital unit may beprovisioned to connect to any patient monitor deployed on that unit. Thepolygamous connection profile is agile, but requires additionalconfirmation steps such as a clinician's confirmation of a patientcontext change or specific rules indicating the ranges at which a sensorshould abandon a first patient context and at which a sensor shouldacquire a new patient context. The polygamous connection profile isuseful when, for example, a hospital unit has multiple sensor devicessuch as thermometers and a clinician may use any thermometer in anyroom. Here, the thermometer would require the clinician to either enterthe patient context, indicate which patient monitor the thermometershould upload data to, or depend on a rules engine with pre-determinedranges for breaking/making patient context changes. Using the rulesengine, the thermometer might connect to a monitor that is within arange of 1-m. If the thermometer detects multiple monitors withinapproximately 1-m range, for example 1.2 and 1 meter, then the rulesengine may query the clinician to confirm the monitor rather than makingan automatic confirmation. The ranges and rules are determined by theclinical work flow and physical setup in a given environment. Duringprovisioning, the sensor device is programmed with the clinical profile(including connection) parameters. For example, a thermometer may beprovisioned for spot monitoring and a polygamous connection profile asfollows:

-   -   When the sensor device is within 1 meter of a patient monitor        and there is no current connection to a monitor, the sensor        device attempts to connect to that patient monitor.    -   Moving more than 5-m from the connected monitor results in a        disconnect and removal of any existing PID.    -   As long as no other patient monitor is within the 1 meter range        and the current monitor is within a 5 meter range, the sensor        device stays connected for 5 minutes, with the connection timer        reset each time a physiological measurement is made.    -   If another patient monitor is within the 1 meter range, the        current monitor is within the 5 meter range, and the time has        not expired, a request is annunciated to confirm a change of        patient monitor.    -   When connecting to a new patient monitor, the system associates        the thermometer data with the patient context of the new patient        monitor.

With the polygamous connection profile, a clinician making multipletemperature measurements in a first room stays connected, but upon aroom change, the first patient context and connection to the firstpatient monitor are cleared. For another sensor device, such as EKG, arule may be to remove the patient context and patient monitor connectionwhen the sensor device is removed from the patient. However, this mightcause the patient context to be lost when EKG electrodes are changed.Additional rules may be added to the connection profile such as removingpatient context from the sensor device when the distance between thesensor device and another connected device on the patient is greaterthan a predetermined threshold and when a time that the distance isgreater than the predetermined interval is more than a predeterminedtime interval. For some workflows, a patient may be confined to onelocation, for example a hospital bed, for an extended period of time.For other workflows, a patient may be ambulatory and move around theirroom or a hospital floor. During a workflow in which a patient isambulatory, it may be desirable to monitor the location of the sensordevice and to change the patient monitor device or gateway that receivesdata from the patient device to a patient monitor device or gateway thatis closer to the sensor device. As the patient moves around the hospitalthe ranging mechanism on the sensor device may determine that the sensordevice is moving out of the range of the patient monitor 208 and is nowcloser to a different gateway device. As the sensor device moves out ofthe range of the patient monitor 208 and comes into the range of anothergateway device, the sensor device may transmit sensor data to thegateway device that is now in range. However, because the sensor devicehas the patient context, the gateway device correctly identifies thedata as belonging to the patient.

When determining which gateway to connect to, the sensor device may useother metrics in addition to distance. Some examples of additionalmetrics include signal strength, noise level on a floor, interferencelevel, retry rate, the number of devices already connected to aparticular gateway, etc. Other examples are possible. In addition, thesensor device may be configured to connect to a specific gateway whenmultiple gateways are at the same distance from the sensor device.

When a determination is made whether to switch gateways, it may bedesirable to determine an absolute location of the sensor device. In ahospital setting, the location of each fixed gateway device and patientmonitor is typically known. When a sensor device is moved to be in closeproximity with a gateway device, once it is determined that the sensordevice is within close proximity (at a range, r) of the gateway device,because the location of the gateway device is known, the location of thesensor device is also known to be on a sphere of radius r with center atthe location of the gateway. If r is small, perhaps less than 25 cm, itcan be assumed that the sensor and the gateway are co-located. There maycases where the sensor device is within range of more than one gatewaydevice. When the sensor device is within range of more than one gateway,a method of interpolation, for example triangulation, may be used todetermine a more precise location of the sensor device. For example, ifthe sensor device is within range of three gateway devices, the locationof each of the three gateway devices may be considered as a point on atriangle. Using triangulation, the center of the triangle may bedetermined and established as the absolute location of the sensordevice. Once the absolute location of sensors is known, the sensorsthemselves may be used to triangulate the location of yet additionalsensors.

Gateways may transmit to back-end server ranges and/or locations ofsensor devices that are connected and sensor devices that are detected,but not connected, for the purpose of location. Knowing the location ofa sensor device, and hence the location of the patient permits alarms tobe escalated to the closest clinician and provides alerts if the patientmoves out of a designated area. In addition, knowledge of sensorlocation permits sensors to be located when lost and permits alerts ifsensors are moved out of a specific area. When periodic maintenance isrequired on a group of devices, a biomedical engineer may query theback-end server for the last-known location of devices. As a theftdeterrent, sensors may be automatically disabled when the sensorlocation is not within certain parameters, such as a particular area ofa hospital. As a second theft deterrent, the sensor may be automaticallydisabled except when making an initial connection to a particulargateway. This would allow the sensor assigned to a particular room toconnect to the gateway in that room, and then roam as the patientambulates. However, if the sensor has not made a reading recently, itwill only connect to its particular gateway.

When communicating status and control information between the sensordevice and gateway device, the radios on the sensor device and gatewaydevice preferably implement a method to transmit status and controlinformation and physiological data without needing to switch operatingmodes. The method is implemented by via an application programminginterface (API) on the sensor and gateway devices. Examples of statusand control information include signal strength, current network status,authentication status, changes to alarm thresholds, charging status,over- and under-voltage detection, and battery charge level. Otherexamples of status and control information are possible.

Ranging information may also be used to respond to queries. For example,a sensor device may receive a query when a connection process is started(i.e., when the sensor device is within a predetermined distance ofanother sensor device or the patient monitor). The query may be issuedto indicate that the connection process has been started and to confirmthat the connection process should be completed. The sensor device mayrespond to the query by moving the sensor device closer to or fartheraway from the other sensor device or the patient monitor. A movement ofthe sensor device toward the other sensor device or patient monitor maybe interpreted as a “yes” and a movement away from the sensor device orpatient monitor may be interpreted as a “no”. In other examples, a “no”may represent movement toward the other sensor device or the patientmonitor and a “yes” may represent movement away from the other sensordevice or the patient monitor.

Alternatively, an accelerometer may be used to detect motioncorresponding to a “yes” or a “no”. For example, movement of the sensordevice up and down may constitute a “yes” and movement of the sensordevice from side to side may constitute a “no”. In other examples,movement of the sensor device up and down may constitute a “no” andmovement side to side may constitute a “yes”. Moving the sensor deviceslowly may constitute a “no” and moving the sensor device rapidly mayconstitute a “yes”

As another example of the use of ranging motion to respond to queries, aclinician may use sensor motion to indicate whether a temperaturereading is correct. Sometimes there may be an error in a temperaturereading obtained via a thermometer. Through a certain motion, per theexamples above, a clinician can confirm that the temperature reading iscorrect and have the temperature reading transmitted to an EMR/EHRsystem or cause the reading to be deleted.

Ranging information may be used to detect relative motion between twomedical devices as the range increases or decreases. Detection of motioncan cause a state change of the medical device and/or the radio. Sinceranging requires power, it is advantageous to minimize use of theranging function for battery-operated devices; however, minimizing useof the ranging function may cause a lag in response time. An adaptiveranging function that determines range perhaps every 1 second coulddetermine when the sensor is being moved and then change the rangingrate to every 0.1 seconds, for example, to provide fast response andability to detect finer motion. When the ranging function determines thesensor is within a certain range of another sensor or medical device, itmay cause the radio state to change from discoverable state toconnectable and it may move the radio from a standby (ranging only) to afully-on state to allow the connection to be made. When a first sensor'sradio determines it is within a certain range of a second sensor, anoutput from the first sensor's radio may cause the first sensor to movefrom a standby or off state to a fully on state. Ranging values may beaveraged for higher accuracy.

In some embodiments as explained later, the radio on the sensor devicemay operate in a low-power mode. In these embodiments, the proximitydetection feature of the radio may be used to turn on a sensor devicewhen another sensor device, for example the SPO2 sensor, or gatewaycomes into close proximity or when certain criteria are met. Forexample, the radio may turn on the sensor device, putting the sensordevice in a connectable state, when a MAC address matches. Othercriteria may include detecting a specific device profile and throughaction such as an accelerometer, physical contact and detection of amagnet or a magnetic field produced by a coil carrying a current. Uponinitial power-up, the radio may go immediately into a first mode toquickly detect devices and then go into a lower-power mode. In thelower-power mode, the sensor device may detect other devices or may bedetected by other devices, although not as rapidly as during initialpower-up.

The API on the sensor and gateway devices also permits configuration ofthe radio on the sensor and gateway devices to configure the radio tosleep and to awaken the radio when a sensor or gateway device is readyto transmit data. For some sensor devices, the radio may remain in asleep mode until an alarm occurs. The alarm may be related to aproximity detection beacon or to a wake-up check message requestingstatus from the radio. When the alarm occurs, the radio awakens toprocess the alarm. The API may also allow configuration to optimizechannel robustness vs. power. For example, in a 54 Mbps channel, 3 Mbpsrequires the transmitter to only have a 5.5% duty cycle; however, theremay be a 17 dB improvement in receiver sensitivity at 6 Mbps vs. 54Mbps.

As noted, the sensor devices used in the PAN are wireless devices.Because wireless devices are inherently less reliable than wireddevices, the radio on the sensor devices incorporate forward errorcorrection or other means to recover packets that are received withouttransmission errors.

In example embodiments, the sensor devices in a PAN may all be in therange of a hub device such as patient monitor 208. In these embodiments,when one sensor device detects a radio of a sensor device not already onthe PAN, the sensor device communicates the detection of the sensordevice to the other sensor devices on the PAN and to the patientmonitor. As a result, the patient monitor moves to a state in whichdetection and connection can occur rapidly.

In example embodiments, the ranging capability of the sensor device mayalso support a scatternet. A scatternet is a network that comprises twoor more personal area networks, each personal area network having two ormore RF enabled devices. In a scatternet, at least one of the RF enableddevices is a member of two PANs, allowing communication between PANs. Ina BT scatternet, this device is a slave in one PAN and a master inanother. In a scatternet, there is an intersection of personal areanetworks such that one slave Bluetooth enabled device is part of each oftwo intersecting personal area networks. With UWB ranging, RF-enableddevices in the scatternet may connect to each other securely usingrange-based authentication.

FIG. 3 show an example patient monitor 300. The example patient monitor300 is a portable device and includes two example proximity detectors308 and 310. The proximity detectors 308 and 310 are mounted internallyin the patient monitor 300 with one surface of each of proximitydetectors 308 and 310 being adjacent to an external surface of thepatient monitor 300.

Also shown in FIG. 3 are two example physiological sensor devices 304,306, each including a proximity detector, possibly disposed as part ofthe radio. Physiological sensor devices 304, 306 are both proximal tothe proximity detector 308 disposed in patient monitor 302 and may bothjoin the patient monitor PAN using range-based authentication. Inexamples, more or fewer proximity detectors may be used and theproximity detectors may be located on different areas of the patientmonitor 300, or as an external device, perhaps connected via USB to thepatient monitor.

FIG. 4 shows an example physical view for the proximity detectionmechanism for physiological sensor 110 and proximity detector 202 thatis separate from the radio. Physiological sensor 110 is housed in aplastic housing 402 and includes a printed circuit board (PCB) 404 thatincludes sensor electronics 204 and Bluetooth radio 206 (not shown), amagnet 408 and a magnetic detector 406. The magnet 408 and magneticdetector 406 comprise proximity detector 202. Patient monitor 208 ishoused in a plastic housing 410 and includes a printed circuit board412, a magnet 416 and a magnetic detector 414. The magnet 416 andmagnetic detector 414 comprise proximity detector 210. Patient monitor208 includes the Bluetooth radio 216 (not shown). When physiologicalsensor 110 is moved into close proximity with patient monitor 208,magnet 408 on physiological sensor 110 activates magnetic detector 414in patient monitor 208 and magnet 416 on patient monitor 208 activatesmagnetic detector 406 on physiological sensor 110.

The magnetic detectors 406, 414 are typically a magnetic switch such asa reed switch, a reed relay, a Hall Effect sensor, a Hall Effect switchor a giant magnetoresistance (GMR) detector. These magnetic switchespermit proximity detection using very low power.

The reed switch is a normally open switch, thereby drawing little or nopower in the open state. The reed switch closes when a magnetic field ofa predetermined threshold is detected by the reed switch. A typicalthreshold for a sensitive reed switch may vary between 5 Ampere-Turnsand 15 Ampere-Turns. However, this assumes a uniform magnetic fieldalong the axis of the axially leaded part.

A Hall effect sensor generates a voltage in response to a magneticfield. The generated voltage increases as the magnetic field increases.For example, when a magnet is moved in the proximity of the Hall effectsensor, the magnetic field of the magnet cutting through the sensorincreases as the magnet is moved closer to the Hall effect sensor. TheHall effect sensor may be combined with circuitry such as a comparatorthat permits the Hall effect sensor to act as a switch. When themagnetic field reaches a predetermined threshold, a magnetic switchcloses, signifying an “on” state. A sensitive Hall effect sensor mayoperate at field strengths of around 10 to 25 Gauss, depending ontemperature and frequency of the magnetic field.

A GMR switch includes giant magnetoresistance material and makes use ofthe concept of magnetoresistance. With magnetoresistance the electricalresistance of the GMR material changes its value when a magnetic fieldis applied to it. When the magnetic field reaches a predeterminedthreshold, the resistance of the GMR material is changed to a point suchthat sufficient current flows through a bridge in the GMR switch toclose the GMR switch, signifying an “on” state. Some GMR switches, forexample GMR switches in the AFL200 series from NVE Corporation, requireonly a few microamperes of supply current. A sensitive GMR switch mayoperate at a field strength of 7-13 Gauss.

Whether the magnetic switch is normally open or normally closed is notrelevant to the detection of an applied magnetic field; rather only thestate change is important.

Magnetic flux densities decrease in strength exponentially withincreasing distance from the source of the magnetic field, for example amagnet. The magnet 408 must be strong enough to activate magneticdetector 414 when physiological sensor 110 is brought in the proximityof the magnetic detector 414. However, at the same time, the magnet 408must be positioned so that the magnet 408 does not falsely triggermagnetic detector 406 or any other magnetic detectors in other medicaldevices that may be implanted on a patient. For example, implantablecardio defibrillators may have embedded magnetic detectors that aretypically activated at a field strength of greater than 10 Gauss.However, in order to create a magnetic field that is reliably detectableby magnetic detector on a patient monitor 208, magnet 408 and magnet 416may need to provide a magnetic field or more than 10 Gauss.

Each magnet 408, 416 is located on the outside of their respectiveplastic housing 402, 410. Each magnet 408, 416 is recessed in theplastic housing 402 and positioned so that one side of each magnet 408,416 is flush with a side of the plastic housing 402. The reason magnets408 and 416 are located on the outside on their respective plastichousing 402, 410 is to permit the use of a weaker magnet than would beneeded if the magnets 408 and 416 were located within their plastichousing. The reason for this is the exponential decrease in magneticflux density with distance. Suppose a magnet were placed on the insideof the plastic and had sufficient magnetization to create a field of 10Gauss at 4 mm outside the plastic. Comparing to a magnet recessed asindicated by magnets 408 and 416 that has sufficient magnetization tocreate a field of 10 Gauss at 4 mm from the outside of the plastic, thelatter magnet would be weaker and its field strength at more than 4 mmfrom the outside of the plastic will be less than the field strength ofthe stronger magnet placed inside of the plastic.

Using a weaker magnet minimizes the risk of false triggers for medicaldevices that contain embedded magnetic detectors. Placing magnets 408and 416 on the outside of their respective plastic housings placesmagnet 408 closer to magnetic detector 414 than would be the case ifmagnet 408 were located inside of plastic housing 402 and places magnet416 closer to magnetic detector 406 than would be the case if magnet 416were located inside of plastic housing 410. Typically, the spacing gapbetween magnets 416 and magnetic detector 406 and between magnet 408 andmagnetic detector 414 is reduced by 2 millimeters by placing magnets 408and 416 on the outside of their respective plastic housings.

Physical detents may be included in the plastic housing to help the userproperly locate the sensor 110 relative to patient monitor 208 totrigger the proximity detection. Labels may be used over the magnets 408and 416 and over the magnetic detectors 406 and 408 to help guide theuser to place the physiological sensor 110 in proper alignment with themagnetic detector in monitor 208.

FIGS. 5 and 6 show a flowchart 500 for a method for using proximitydetection to establish a connection between a sensor device, for examplephysiological sensor 110 and a gateway device, for example patientmonitor 208. At operation 502, a radio on the sensor device is in anon-connectable state. Typically, both the radio and the sensor deviceare powered off. An internal retry count is set to zero.

At operation 504, a determination is made whether a proximity detectoron the sensor device is activated. The proximity detector on the sensordevice is typically not activated until the sensor device is proximal tothe gateway device. The determination of whether the proximity detectoris activated comprises whether a magnet, for example magnet 416 on thegateway device activates a magnetic detector, for example magneticdetector 406 on the sensor device. Depending on the strength of themagnet on the gateway device, the sensor device may need to be movedwithin centimeters of the gateway device or in some examples the sensordevice may need to physically touch the gateway device in order for themagnetic detector to be activated.

When a determination is made at operation 504 that the proximitydetector is not activated, control loops back to operation 502. Controlloops between operation 502 and operation 504 until the proximitydetector is activated.

When a determination is made at operation 504 that the proximitydetector is activated, at operation 508, the Bluetooth radio on thesensor device is set to a connectable state, in low-power. This includespowering on the radio if it was not powered. The use of low-power radiotransmission during connection improves security during the connectionprocess, but is not required.

At operation 510, a determination is made as to whether the sensordevice detects a second radio device, for example a Bluetooth radio, onthe gateway device and whether the gateway device detects a radio deviceon the sensor device. Typically, proximity detection occurs nearsimultaneously at sensor device and the gateway device and each placesits respective radio in a connectable state. This connectable state mayinclude also being discoverable. However, the Bluetooth radio on thegateway device may turn on at a slightly different time than theBluetooth radio on the sensor device. It is also possible that onemagnetic detector was triggered and the other was not. If theout-of-band proximity detection transmits the MAC address, discoverytimes may be significantly decreased compared to methods such as paging.

If a determination is made at operation 510 that a second Bluetoothradio is not detected, typically because there is a slight delay inturning on power for the second Bluetooth radio, at operation 510 aretry count is incremented. At operation 512, a determination is made asto whether a retry limit has been reached. When it is determined atoperation 512, that a retry limit has not been reached, control returnsto operation 508 and another determination is made as to whether asecond Bluetooth radio has been detected. When it is determined atoperation 512, that a retry limit has been reached, control returns tooperation 502 and the sensor device is put back in a non-connectablestate. Alternatively, instead of a fixed number of retries, adetermination may be made at operation 512 as to whether a timeout limithas been reached.

When a determination is made at operation 510 that a second Bluetoothradio has been detected, at operation 516, Bluetooth pairing isperformed between the sensor device and the gateway device.

At operation 518, the radio devices are set to a standard power leveland the sensor device is paired to the gateway device. For example,standard power is 4 dBm for a Class II Bluetooth radio and 20 dBm for aClass I Bluetooth radio.

At operation 520, status and configuration information are transferredbetween the sensor device and the gateway device. The status andconfiguration includes such items as the strength of a battery on thesensor device and the model and version numbers of the sensor device andthe gateway device. The status and configuration information aretransferred in an attempt to determine whether the sensor device isoperationally compatible with the gateway device.

At operation 522, a determination is made as to whether the sensordevice and the gateway device are compatible. The determination is madeby comparing the model number and version of the sensor device with themodel number and version number of the gateway device to a file ordatabase indicating the set of compatible versions and models.

When it is determined at operation 522 that the sensor device and thegateway device are not compatible, at operation 524, a status messagethat the sensor device and gateway device are not compatible isdisplayed to the user. This status message might be displayed on thegateway device, the sensor device, a syslog server, through e-mail orother electronic communication. At operation 526, the logical connectionbetween the sensor device and the gateway device is broken and theconnection sequence ends. Breaking the logical connection might be atthe application layer or at the RF layer and might include removingstored pairing information. The incompatibility message may be sent to aserver. Alternately, the user may be prompted to confirm download of newsoftware that corrects an incompatibility option before destroying theradio connection.

When it is determined at operation 522 that the sensor device and thegateway device are compatible, at operation 528, a message that thesensor device and the gateway device are compatible is displayed on theuser interface of the gateway device and the clinician is prompted toconfirm the patient for the sensor device. The confirmation of thepatient to the sensor device provides an additional level of security toensure that the sensor device is being assigned to the correct patient.

If there is no confirmation determined at operation 528, at operation530, a determination is made as to whether the allotted wait time forthe clinician has expired. If a timeout occurs, meaning that theclinician has not confirmed the patient for the sensor device within areasonable period of time, at operation 524, a message is displayed onthe user interface of the gateway device that the patient has not beenconfirmed for the sensor and at operation 526, the logical connectionbetween the sensor device and the gateway device is broken. At operation530, if the timeout limit has not been reached, then control is returnedto operation 528.

When the patient has been confirmed for the sensor device, at operation532, the connection mode is selected. As discussed, the connection modecan be one of loose pairing, tight pairing or locked. Additionalconnection modes may be created to support additional clinical workflows.

FIG. 7 shows a flowchart for a method of transferring patient context toa first sensor device, for example to SPO2 sensor device 110. Atoperation 702, sensor device 110 is moved within range of a secondsensor device, for example sensor device 108. As sensor device 110 ismoved within range with sensor device 108, sensor device 110 sends outranging signals to sensor device 108. The ranging signals are generatedfrom UWB circuitry in a proximity detector on sensor device 108. Itshould be noted that the second sensor device may be a patient monitor.

At operation 704, a determination is made as to whether the distancebetween sensor device 110 and sensor device 108 is within apredetermined distance threshold. The distance threshold is a smalldistance, typically less than 25 cm, which provides an indication thatsensor device 110 is in close proximity with sensor device 108. When thedistance between sensor device 110 and sensor device 108 is less thanthe predetermined threshold, at operation 706 sensor device 110 isauthenticated on a personal area network that includes sensor device108. The authentication comprises sensor device 110 sending anidentifier to sensor device 108. The identifier, typically a MAC addressof sensor 110, is received by sensor device 108 and sent from sensordevice 108 to a patient monitoring device, for example patient monitor108. Patient monitor 108 sends the MAC address via a gateway, forexample LAN/WAN gateway 218, to an EMR/EHR system. The EMR/EHR systemauthenticates the MAC address. When a sensor device does not have enoughmemory to store a MAC address, a serial number for the sensor device maybe used as an identifier instead of the MAC address.

At operation 708, when sensor device 110 is authenticated, at operation710 a determination is made as to whether the sensor device 110 shouldjoin the PAN. The determination as to whether sensor device 110 shouldjoin the PAN is typically based on multiple factors. One factor may bethe distance between sensor device 110 and sensor device 108. A secondfactor may be the time interval that the distance between sensor device110 and sensor device 108 is within the predetermined threshold. A thirdfactor may be whether a physiological measurement has been made fromsensor device 110. Other factors may be considered.

At operation 712, when a determination is made that sensor device 110should join the PAN, at operation 714, patient context is obtained andstored on sensor device 110. The patient context, typically anidentifier for the patient, is obtained from patient monitor 208 or fromthe EMR/EHR system via gateway 218. At operation 716, when physiologicaldata is sent from sensor device 110 to patient monitor 208, the patientcontext is sent along with the physiological data. Sending patientcontext along with the physiological data helps ensure that thephysiological data is identified as being associated with the correctpatient and allows the sensor to upload data to any gateway, as would beuseful for ambulatory patients.

FIGS. 8 and 9 show a flowchart 800 for a method for using UWB ranging toestablish a connection between a sensor device, for examplephysiological sensor 110 and a gateway device, for example patientmonitor 208. At operation 802, a radio on the sensor device begins lowrate ranging. In examples, for low rate ranging, the radio on the sensordevice may send out ranging signals at a rate between one ranging signalevery second to one ranging signal every 30 seconds. In other examples,different rates may be used for low rate ranging. In examples, theranging signal may comprise more than one signal. Low rate ranging istypically used when it is unknown how far the sensor is from the gatewaydevice. In this situation, low rate ranging may be used to conservebattery power.

At operation 804, a determination is made as to whether the gatewaydevice is within a first range of the sensor device. In examples, thefirst range of the sensor device may be a distance of 5 meters. Othervalues for the first range may be used.

When it is determined at operation 804 that the first sensor device isnot within the first range, control returns to operation 804 and anothercheck on the first range is made. When it is determined at operation 804that the first sensor device is within the first range, at operation808, the radio on the sensor device begins high rate ranging. High rateranging comprises sending out ranging signals at a higher frequency thanfor low rate ranging. In examples, high rate ranging may comprisesending out one or more ranging signals every 0.05 to 0.5 seconds. Otherfrequencies of high rate ranging may be used.

At operation 810 a determination is made as to whether the gatewaydevice is within a second range of the sensor device. The second rangeis a smaller value than the first range, corresponding to apredetermined distance threshold, as discussed earlier herein. Inexamples, the second range may be a distance of 50 cm. Other values forthe second range may be used.

When a determination is made at operation 810 that the gateway device isnot within the second range of the sensor device, at operation 812 adetermination is made as to whether a retry limit or timeout has beenreached. When a determination is made at operation 812 that a retrylimit or timeout has been reached, at operation 806, the first range isadjusted to a lower value. In examples, the first range may be reducedby 50 percent. In other examples, the first range may be reduced by adifferent amount. One reason for reducing the first range at operation806 is to reduce the amount of time that the sensor may be in a highrange mode, thereby conserving battery power on the sensor. Control thenreturns to operation 802, returning the sensor to low rate ranging. If adetermination is made at operation 812 that neither a retry limit nortimeout has been reached, control is returned to operation 810.

When a determination is made at operation 810 that the sensor device iswithin the second range, at operation 816, range-based authenticationand pairing is performed between the sensor device and the gatewaydevice.

At operation 818, the first range is reset, typically to a defaultvalue. The first range is reset because the first range may have beenchanged at operation 806. At operation 819, the sensor device begins lowrate ranging.

At operation 820, status and configuration information are transferredbetween the sensor device and the gateway device. The status andconfiguration includes such items as the strength of a battery on thesensor device and the model and version numbers of the sensor device andthe gateway device. The status and configuration information aretransferred in an attempt to determine whether the sensor device isoperationally compatible with the gateway device.

At operation 822, a determination is made as to whether the sensordevice and the gateway device are compatible. The determination is madeby comparing the model number and version of the sensor device with themodel number and version number of the gateway device to a file ordatabase indicating the set of compatible versions and models.

When it is determined at operation 822 that the sensor device and thegateway device are not compatible, at operation 824, a status messagethat the sensor device and gateway device are not compatible isdisplayed to the user. This status message might be displayed on thegateway device, the sensor device, a syslog server, through e-mail orother electronic communication. At operation 826, the logical connectionbetween the sensor device and the gateway device is broken and theconnection sequence ends. Breaking the logical connection might be atthe application layer or at the RF layer and might include removingstored pairing information. The incompatibility message may be sent to aserver. Alternately, the user may be prompted to confirm download of newsoftware that corrects an incompatibility option before destroying theradio connection.

When it is determined at operation 822 that the sensor device and thegateway device are compatible, at operation 828, a message that thesensor device and the gateway device are compatible is displayed on theuser interface of the gateway device and the clinician is prompted toconfirm the patient for the sensor device. In addition, the gatewaydevice transfers patient context to the sensor device. The confirmationof the patient to the sensor device provides an additional level ofsecurity to ensure that the sensor device is being assigned to thecorrect patient. In some conditions when it is there is no ambiguity asto whether the patient should be confirmed for the sensor, the systemmay automatically confirm the patient for the sensor and transfer thePID.

If there is no confirmation determined at operation 828, at operation830, a determination is made as to whether the allotted wait time forthe clinician has expired. If a timeout occurs, meaning that theclinician has not confirmed the patient for the sensor device within areasonable period of time, at operation 824, a message is displayed onthe user interface of the gateway device that the patient has not beenconfirmed for the sensor and at operation 826, the logical connectionbetween the sensor device and the gateway device is broken. At operation830, if the timeout limit has not been reached, then control is returnedto operation 828.

When the patient has been confirmed for the sensor device, at operation832, the connection mode is selected. As discussed, the connection modecan be one of loose pairing, tight pairing or locked. Additionalconnection modes may be created to support additional clinical workflows.

A physiological sensor and monitor that incorporate Bluetooth technologyare computing devices and typically include at least one processingunit, system memory and a power source. Depending on the exactconfiguration and type of computing device, the system memory may bephysical memory, such as volatile memory (such as RAM), non-volatilememory (such as ROM, flash memory, etc.) or some combination of the two.System memory typically includes an embedded operating system suitablefor controlling the operation of the sensor device. The system memorymay also include one or more software applications, for exampleBluetooth, and may include program data.

The various embodiments described above are provided by way ofillustration only and should not be construed to limiting. Variousmodifications and changes that may be made to the embodiments describedabove without departing from the true spirit and scope of thedisclosure.

What is claimed is:
 1. A wireless medical device, the wireless medicaldevice comprising: a processor; a memory; a sensor for detecting aphysiological signal; a radio; and a proximity detector to measure adistance of the wireless medical device relative to a second wirelessmedical device, the proximity detector including a rangingfunctionality, wherein a wireless communication channel is created whenthe distance measured by the proximity detector between the wirelessmedical device and the second wireless medical device is within a firstpredetermined threshold, the distance being greater than zero, wherein,upon establishing the wireless communication channel, the wirelessmedical device receives a patient context from the second wirelessmedical device, the patient context providing an identifier for apatient; wherein the patient context is transmitted from the secondwireless medical device to the wireless medical device over a channelthat is different from the wireless communication channel, with thechannel using a different communication method from a primarycommunication method used for the wireless communication channel; andwherein the patient context is removed from the wireless medical devicewhen: the distance between the wireless medical device and the secondwireless medical device is greater than a second predetermined thresholdfor at least a predetermined time interval; or a time since aphysiological measurement has been made at the wireless medical deviceis greater than a predetermined time interval.
 2. The wireless medicaldevice of claim 1, wherein the ranging functionality is implementedusing ultra-wide band technology.
 3. The wireless medical device ofclaim 1, wherein the patient context is obtained from the secondwireless medical device upon detection of physiological signals by thewireless medical device while within the first predetermined threshold.4. The wireless medical device of claim 1, wherein the wireless medicaldevice transfers physiological data to a patient monitor, the patientcontext being transferred along with the physiological data.
 5. Thewireless medical device of claim 1, wherein the patient context isremoved from the wireless medical device based on conditions determinedby a clinical workflow definition for the wireless medical device. 6.The wireless medical device of claim 1, the wireless medical devicefurther comprising a medical device identifier, the medical deviceidentifier providing the patient context for the patient.
 7. Thewireless medical device of claim 1, wherein the wireless medical deviceis powered on when the distance between the wireless medical device andthe second wireless medical device is within a pre-determined threshold.8. The wireless medical device of claim 1, wherein the wireless medicaldevice creates or breaks a connection based on conditions determined bya clinical workflow definition for the wireless medical device.
 9. Thewireless medical device of claim 1, wherein the ranging functionality isused to respond to queries.
 10. The wireless medical device of claim 1,wherein the wireless medical device changes state based upon a detectionof motion of the wireless medical device.